I run a small Docker Swarm with Traefik and Authelia, plus services such as HedgeDoc and Immich. The internal DNS record for auth.example.com points to the Swarm host on ports 80 and 443, and OAuth2 callbacks need to use that HTTPS hostname. DNS resolution works from inside the containers, but connections to the host IP time out. As a temporary workaround, I added an extra_hosts entry pointing auth.example.com to a Traefik-related IP, but that address can change after a reboot because container IPs are assigned dynamically. Connecting directly to Authelia over its internal HTTP port is not suitable because it requires HTTPS through the reverse proxy. What is the cleanest way to let Swarm containers access the OAuth2 hostname without repeatedly changing IP addresses or weakening Docker's security settings?
2 Answers
The actual problem turned out to be local firewall rules. I had previously added an iptables rule that blocked containers from connecting back to the host’s own IP address. That prevented the request from taking the normal outside route to Traefik. Removing or adjusting that rule restored access to the OAuth2 hostname, so no dynamic Traefik IP mapping was needed.
If Traefik, Authelia, and the application share an external Docker network, you can inspect that network and use its gateway address for the host mapping. The gateway remains stable as long as the external network itself is not deleted and recreated. On newer Docker versions, you may also be able to use `host-gateway` in `extra_hosts` instead of hard-coding an address, which avoids depending on a changing container IP.
That sounds more persistent than using a dynamically assigned container address. Creating the shared network outside the Traefik stack also seems important so stack redeployments do not recreate it.